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I.        INTRODUCTION 

A.        COMBAT    SURVIVABILITY.  .  ..A    TECHNOLOGY    ISSUE 

In  the      skies  today      and  or.      the   drawing      boards    for 
tomorrow      are   military      aircraft      that   ars      t=:chnDlog:.cal 
marvels.         The   F-15,      and    F/A-18      are   saperior    fiahrsr   ard 
attack     aircraft     that      employ      the      very      latest      ir. 
state-of-the-art   technologies    in   computers,      flight   control 
systems,    engines,   and   structural    materials.        These  machines 
have   been      optimized    to      levels    heretofore      unobtainable, 
Psrformance   has    bean    built-in   to   these   aircraft.       And    so   has 

something    else, Survivability.        These      aircraf-    were 

designed   tc   perform      their  assigned   combat    missions      in    the 
face    of    modern   arsenals    and  tc      return   zo    -heir    bases    -o    fly 
again.         However,      the   question    must   bs    asksd,      have    these 
aircraft      designs  realized     the      utmost   in      survivability 
benefits    that      modern   digital   systems   tachnologies      have   to 
offer? 

Because      history    has      shown    that      ths    importance      of 
survivability   has  sometimes  bs^n      forgotten    or    neglected    in 
the      design  and      development      of      military   aircraft      in 
peacetime,      it   is   incumbent  upon    the   aircaft    designer,      the 
military    program   manager,      and   the   combat    aviator   to    en3ur= 
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that    today's   technological  advances,        particularly  ir.    tb.~ 
applicaticn   of      computer    augmented    flight      conircl    systems, 
continue    to   provide    the      survivability   enhancement    features 
thax    will      keep   the    cutting     edge   of   our      nation's   defense 
keen. 

3.        0.    S.     MILITARY   SU RV IV AEILITY    POLICY 

Survivability  has      been  increasingly   emphasized      by   the 
U.S.      Armed   Services    in    recent      years.        The    Depar-ment   of 
Defense    and  the   Military      Service   Branchss   have    established 
firm    survivability     policies   regarding     arms    acquisitions. 
The   primary   objective   of      the   U.S.      Military    Survivability 
Policy  is    to   ensure    that    effective    survivability   enhancemen- 
features    are   incorporated    in   current      and    all   future   U,      S. 
weapons   systems. 

A     triservice     organization,      the      Joint      Technical 
Coordinating      Group    on      Aircraft    Survivability       (JT33/AS) , 
created   in    1971,      has  brought   together  the    oest    expertise    i: 
each      of    the      service    branches      to    plan      and    ex'^cuta      a 
comprehensive    program      to    increase     the   survivability      of 
current   and      future    aircraft   assets.         Within      the    JTCG/AS 
charter   are   tasks     to   develop    design   criteria      and   improved 
technology    to      increase   the  survivability    of      future    combat 
aircraft    and   weapons    systems. 

11 


C.        SURVIVABILITY    REQUIREMENTS/GUIDELINES/Sr ANDARDS 

Survivability  requiremsnts   for      airborne    weapon    sys-^-ms 
hav€   bsan    specified    in   different    ways      by    each    brar.ch    of   th-: 
Armed     Services.  The    Navy     establishai      ASPONAQTICAL 

REQUIREMENT  (AR)-107,  "Navy  Aircr?.ft 

Survivability/Vulnsrability    (Naclear/Ncnnaclear) ,"      in    V37U. 
MIL-STD-2072  (AS)  ,        "Military   Standard:         Survivabili-:  y , 
Aircraft;      Establishment      and   Conduct      of    Programs      for," 
superseded    AR-107  in    1977.        In       1981,      Ihs    Depar-men-    of 
Defense    issued      MIL-STD-2069,      "Requirements      for    Aircraft 
Nonnuclear      Survivability    Programs."        Each    document      was 
prepared   in     recognition    of  the      need    for      a    s-andardiz'rd 
systems   approach      to    improving      the   survivabili-y      of    U.S. 
military    aircraft. 

DOD   MIL-STD-2069      provided   guidelines      and   reguiremen-cs 
for      establishing  and      conducting   aircraft      survivability 
programs.      Applicability    of  the    principles   contained   therein 
apply  to    all   major   weapons     system    acquisi-ion    programs   and 
is    the  standard   invoked      in  contractual   agreements   regarding 
aircraft    armaments. 

Various   forms  of    handbooks  have    been    prepared    to    provide 
military      planners     and    industrial      designers      with     the 
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inf  ormatioL      and     guidance        n?ed<=d      in      incorporating 
survivability    feataras  into  new    and   existing    systsms.         Th^ 
Air   Fores    Systsms      Command  has   published   a      design   handbook 
series,      DH-1    through    DH-3    (with    suppla:nent3)       for    use    with 
Air    Force    programs.       The    Army   has   publisaad   a    "Survivability 
Dasign  Guide    for    Army      Aircraft,"   USAAMRDL    rR-71-ai.         T'n<~ 
Navy      established     MIL-HDBK-268       (AS)  ,         "Survivability 
Enhancement,    Aircraft   Conventional    Weapons   rhr-eats.      Design 
and    Evaluation  Guidelines,"      in    August    1982    for      use    in   the 
acquisition    process    of  Naval   aircraft   systems.      Jointly,    the 
three  services   work   within  the   guidelines    established    by   thr 
JTCG/AS      and        published      in        several      volumes        as 
D3D-MIL-HDBK-336,      "Survivability,      Aircraft,      Nonnuclear, 
(Various)  .  " 

D.        WHY    BE    CCNCEENED    WITH    AIRCRAFT    FLIGHT    CONTROL    SYSTEMS? 

The   essential  question  of      flight   control    surviv=ibility 
was   derived   by  the   author   from   a    stateman-    aminating    from   an 
analysis    of   Southeast      Asia  combat   files    maintained      by   the 
Combat  Data  and   Information      Canter    (CDIC) .        The   statement 
attributed      approximately    25%      of  all      aircraft   lost      in 
Southeast    Asia      to  the   functional      loss  of      the   aircraft's 
flight  control   system    as    a     result    of    combat    induced    damage. 
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This    percentage      figura    equated      to   nearly      SCO    aircruit. 
Preliminary   investigation   revealed    thai;      tha    flight    control 
system  of      most   conventional     comba-    aircraft      contributed 
approximately    5%      to    the    aircraft's   total      pr'^ssnted   ar^a. 
The      disproportionality    of     the    two      figures    generated      a 
concern    that   culminated    in  the   development    of   the    guidelines 
contained    herein. 

E.  PURPOSE 

The    purpose   of  this    treatise    is      to    present    in   a    single 
document    guidelines    for    the     development   of   aircraft    flight 
control    systems    (FCS)      with  specific   emphasis   on   increasing 
the      combat      survivability  of      aircraft      aguipped      with 
Fly-By-Wire    (FEW)    flight    control    systems. 

F.  SCOPE 

The   scope      of  this  effort      was   limitad      to   nonnuclear 
weapons   effects     considerations.         The      Fly-by-Wire  flight 
control   systems   development  guidelines   presented   within    werr 
developed    in   connection    with     the   damage   causing   mechanisms 
associated   with   conventional    weapons   systems,    self   generated 
electromagnetic   interference    (EMI)       phenomena,      and   normal 
inflight      environmental/meteorological   conditions      to      be 
expected    in   the   conbat   aircraft's   operating   environment. 
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II.       FUNDAMENTAL    SURVIVABILITY    CONCEPTS 

A.        WHAT    IS    AIRCRAFT    COMBAT   SURVIVABILITY? 

Aircraft    combat    survivability    has      bser.   d-^finad  as    "-.h? 
capability    of   an   aircraft    (weapon      systai)       to   avoid   and/or 
withstand      a      man-made        hostile      environment"   [Ref.    1]. 
Paramount    in   this  definition   is    the   ability    "-o    avoid    ar.d/or 
withstand."        The      inabili-y      "to      avoid,"      th^      hosiile 
environment   is   referred    to  as   su sceptibili-y .      The    inabiliry 
"to    withstand,"   the      hostile    environment    is   referred      to    as 
vulnerability. 

Susceptibility,       often  measured   as      the    probability   cf 
being  hit,    Ph,   can   be  divided   into   three    general   categories: 

(1)  Defensive   weapon   system   thre=t   activity 

(2)  Detection,      identification,      and   tracking   by 
defensive  weapon    systems 

(3)  Engagement    by  defensive    waapon    systems    (i.e., 
missile    laanch     or  gun   firing;         warhead   guidance; 
warhead   impact   or    detonation) 

The   susceptibility  of   an   aircraft      can    be   influenced    by 
the    aircraft's  signatures,   the   tactics   and    supporting    forces 
employed,         and  the      integral   survivability      enhancement 
equipment    carried  on    or    within      the  aircraft.         Small    size. 
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increased    maneuverability,      low    visual/radar/anral/inf rar si 
signatures,      terrain      masking/te rrain    following      -actios, 
active/passive   electronic    count ermeasures,         decoys,      and 
antiradiat ion    missiles  are     but    a   limits^    sal=-c"^-ion      Tif.    -he 
means  to    reduce   an   aircraft's    susceptibility. 

Vulnerability,      often      measured   as  ths      probability    cf 
being  killed   if    hit,    Pk/h,     is  a    direct   function   and   cieasure 
of    the   aircaft's   design,       and   any   survivabili-y    enhancement 
feature   that    reduces    the    amount    and   effsct    of   damage    induced 
by      an     enemy's      wsapon        systems      damage      mechanisms. 
Vulnerability    is    influenced     by    the   ability   of      a   sy3-e:n    to 
continue    to   operate   after   being      hit   and    by   design   features 
and    equipment   that   prevent  or      suppress   damage.         A   flight 
control   system   that    continues   to    function    after   sustaining   a 
hit    by  a      damage    mechanism  on    one  cf   i-s      components   is   an 
example   of   reduced  aircraft  vulnerability. 

B.        SUPVIVABILITY   ENHANCEMENT    CONCEPTS 

Survivability     enhancements      have        been      generally 
categorized  as  any   feature  of      an  aircraft,      any   =quip«ient 
carried,      any   tactic    employed,      or    any   combination   thereof 
that    reduces   the   susceptibility      and/or   the    vulnerability   of 
an    aircraft.        Survivability   enhancements    can    be   separately 
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concentra-ted   in*Q   either      susc=ptibili-y    reduction    f?  =  -ures 
or      vulnarability  reducticn     fsaturas.        Those      specific 
susceptibility  and  vulnerability    reduction      features   can   be 
summarized   generically  into  conceptual   sl8m9nT:s.        The    firs- 
of    the      two  categories      relating   the      major   survivability 
enhancement   concepts    is    listed  in   Table   I. 

TABLE    I 
Survivability  Enhancement   Concepts   -    Suscep-ibilii- y 

Reduction 

(1)  Signature  Reduction 

(2)  Warning  Receivers 

(3)  Electronic  Countermeasur ss  Devices 

(4)  Expendables 

(5)  Tactics 

(6)  Threat    Suppression 

As  presented    in   Table    I,        a    reduction    in    an   aircraft's 
susceptibility      can    be     brought    about      by    decreasing      its 
detectability  through      signature    reduction.  Reducing   an 

aircraft's   ability  to      be   detected    and   tracked      by   an    enemy 
can      best      be     accomplished      in      the      design      process. 
Incorporation   of   quieter,    smokeless    engines,    utilizing    rada: 
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absorbent      materials,      eliminating      sharp    edges       (corr.Tr 
reflectors),    and   prescribing   low    IP.   reflective   paint    schemes 
are    examples     of   this   technique.  Alerting    the      crew    to 

impending    missile  Dr      gun    activity   can    be      achieved  through 
the      use    of     appropriately     selected   warning      receivers. 
Incorporating   electronic    counter  measures      devices,      such   as 
noise   jammers      and   deception     repeaters,      can      degrade    or 
prevent   an   enemy's      defensive   systems    abili-y   to      achieve   a 
suitable    weapons   firing    solution.        Expendables,    in   the    form 
of    chaff,    infrared  flares,    and   off-board   decoy    devices,      can 
confuse   and    degrade    an  enemy's      weapon   systems   by    masking   an 
aircraft's   true      identity    or   location.  Hinimiza-ion    of 

exposure    to   an      enemy's    defensive   network    can      be   achieved 
through      a   suitable      selection      of    tactics      alternatives. 
Examples   of   this   technique  can   be   found  ia    operational    plans 
that    take      advantage    of    terrain      following/terrain   masking 
flight      profiles        and      that     utilize        stand-off      or 
launch-and-leave   weapons.  The    impact   of    craw      skill   and 

experience   and  the   increased    parformance    capabiliries    of   th-5 
modern   fighter/attack   aircraft,     brough-   about,    in    part,      by 
the    incorporation  of    FBW      flight    control    systems   technology, 
can    have      a   major  impact      on   tactics      silection.        Threat 
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suppression,      the  ability      to    activ?ly   deny   the      9n=my    an 
unhindered   opportunity  to   fire   his   weapons,      can    bs   a-hi?v^d 
by   attacking    his      weapons    emplacements   with   such      means   as 
anti-radiation   missiles    and  coordinated   supporting    fire    from 
ancillary    units. 

The   six   concepts    described   above   comprise    susceptibility 
reduction,      the   avoidance    portion   of  the   survivability    dual. 
Completing      the      dual  are      six      vulnerability      reduction 
concepts.      These   six    complementary    concepts   are   presented    in 
Table  II. 

TABLE    II 
Survivability    Enhancement    Concepts    -   Vilnerability   Reduction 

(1)  Component  Location 

(2)  Component  Shielding 

(3)  Component  Redundancy 
(U)  Component  Elimination 

(5)  Passive    Damage    Suppression 

(6)  Active    Damage    Suppression 

Vulnerability  reduction     can    be      b=st    achieved      in    the 
design  phases      of  an    aircraft's      de velopm=nt.        Judicious 
selection    of    the   location    of  critical   componen-s   to   minimize 
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the   possibili-^y      of.  damage     and    shielding      thosa   critical 
CDmponsnts    to      prevent   damage    mechanisms    from      striking    th? 
components,    rendering  them  unssr vicable,    are    -cechniqaes   mcs- 
suited  to      be   achiBved      during  the      early    design      phases. 
Incorporation   of     more   than     one    component      to   perform      a 
critical    function    (component   redundancy)         can    have   =    major 
impact  on      the   vulnerability   of      an   aircraft      or   aircraft 
system.         Additional    reductions    may   be   achieved    through   the 
elimination   of   components     entirely    (cooipDnent   elimination)  . 
Passive    and     active    damage     suppression   reduces      aircraf- 
vulnerability   either      by    controlling   the    effects      of    damage 
mechanisms   or     by  reducing     or   preventing      the   subseguent 
spread  of    further  damage   causing    effects. 

Suitable   attainment    of  an      appropriate    level   of  aircraft 
survivability   can  be    achieved      through    ths    incorporation   of 
elements   from   each   of   the   survivability   enhancement   concep-s 
described.         However,         it  must    be      notsi    that      not   all 
survivability      enhancement     concepts      are      necessary      or 
appropriate      for   any      particular      aircraft      type   on      any 
particular      mission.         Paradoxically,         a    redaction      in 
vulnerability      may      lead      to        a      greater      degree      of 
susceptibility,      such   as    the   case   faced   by    the    designer    when 
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adding  large   amounts    of   armor    plate   to   an    aircrafr,      ^hareb/ 
increasing   the   ability   to    tolerate      a    hit,       but    making    the 
aircraft    more     susceptible  to   being      hi-    by      raducing    its 
speed.  Consequently,       the      early    identification      and 

successful   incorporation    of     those    survivability   enhancement 
features    that    most  significantly      increase   the    survivability 
of    the  aircraft's      flight   control   system   and      increase   the 
mission   effectiveness   of      the   combat   aircraft   as      a  weapons 
system  is      to    be   regarded   as      a    goal   of      the    survivability 
discipline. 
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III.        FLIGHT    CONTSOL    SYSrE^IS 

A.        FLIGHT    CCNTRCL    BASICS 

Flight  path  control  of  an  aircraft  is  accomplished  by 
msans  of  a  complex  series  of  slectrical,  hydraulic,  and 
mechanical  devices  collectively  titled  the  flight  control 
system  (FCS)  .  These  basic  elements,  when  transformed  into 
sensors,  signal  paths,  actuators,  and  surface  panels, 
provide  the  means  by  which  the  pilot  comaiands  an  aircraft 
in-flight    about   the   three   axes   of  motion. 

Conventional   military     aircraft    utilize      rhree    primary 
control    surfaces   to    control  the      three   dimensional   motion   of 
the    aircraft:    the  elevators,    the    rudder   and   the    ailerons.      A 
right-hand   orthogonal   axis  system      and  the    motions   produced 
by    the  associated  control   surfaces    are   illustrared   in    Figure 
3.  1. 

Deviations  froi    the    basic   control   surfaces   are    functions 
of   the  geometric   shape  of     the   aircraft.         In   some   aircraft 
configurations,      the      elevators    are      replaced   by      a   solid 
horizontal      tail,      designated      either      a   stabilator      or 
stabilizer   by   the  nanuf acturer ,    which   moves   as   a   single    unit 
to    provide   pitch     control.        In    some   aircraft,        -he    tail 
surfaces      can      be  controlled      either      syametrically      ^r 
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Lateral  Axis 


Positive  Pitching 
Moment 
M 


Center  of  Gravity 


Longitudinal 

Axis       Positive 

Rolling  Moment 
L 


Positive  Yawing 

Moment 

N 


Vertical  Axis 


Figure    3.1.      Befsrence    Axes/Control   Surface  Deflections 

assymmetr ically   to   provide   pitch      and    roll    control.        This 
type   of   tail   surface    is      known  as  a   differential  stabilator. 
Tailless    aircraft  employ      elevens  in   place    of      ailerons    and 
elevators    to      provide   pitch  and    roll     control.        Flaperons 
replace   ailerons    in    still   other    designs. 

Additional   surfaces,      such      as   speedbrakes,      spoilers, 
leading   and  trailing    edge    flaps,    and   leading   edge    slats,    ara 
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classified  as      secondary    or     auxiliary  control      surfaces. 
These  devices      provide  an    aircraft      a   maans   of      speed   and 
direct  lift   control,        and  can  be   used      as    back-up   control 
surfaces.  Despite      the      nomenclature      and      physical 

differences,      the  primary    function     of   a    particular   control 
system  configuratiDn    remains   to    guide      the   aircraft   in    "chree 
dimensional   flight, 

B,  MECHANICAL    FLI3HT    CONTROL    SYSTEM    BASICS 
Conventional     flight      control   surface      movements      are 

commanded    by      the  pilot      through    the     control   column      and 
control   pedals.        Movement  of   the     elevator   and   ailerons   is 
commanded    by    means     of  a    stick   or      wheel   controller,      and 
movement   of  the     radder    is  prescribed   by   a      pair   of  rudder 
pedals.         The   basic    mechanization      scheme    is   illustrated    in 
Figure   3,2.  The  control  column      and   rudder      pedals    are 

mechanically    linked      to    the     control   surfaces      by   cables, 
pushrods,      and   bellcranks   as   illustrated    in   Figure   3,3    for   a 
longitudinal   control    system, 

C.  POWER-ASSISTED   CONTROL   SYSTEM    BASICS 

Most  high  speed  military  combat  aircraft   require  some 
form  of   powered  flight  control   system  to  give   the  pilot 
adequate  ccntrcl  of  the   aircraft  throughout   the  flight 
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Figure  3.2.      Mechanical  Flight   Control   Sechanization 
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Figure   3.3.      Mschanical  Longitudinal   Control   System 
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envelope.  Conventional    power-assisted      control      system 

designs  usually  derive  the  additional  power  by  means  of 
hydro-mechanical  devices.  The  fundamental  configuration  is 
depicted  in  Figure  3.4.  The  hydraulic  pump,  selector  valve, 
servcactuators,  and  associated  plumbing,  while  adding  weight 
and  complexity  to  the  control  system,  provide  the  additional 
power  required.  Artificial   feel    devices      are   generally 

incorporated   in   the    mechanical      linkage   to    provide   feedback 
to      the      pilot.  Figure    3.5      illustrates      the      basic 

mechanization      of     a        conventional      hydraulic      powered 
longitudinal  control    system. 

D.        FLY-BY-WIRE     (FBW)     CONTEOL    SYSTEM    BASICS 

Many    modern,        high    technology   combat      aircraft   employ 
fly-by-wire      flight      control   systems.  In      the      basic 

configuration,      illustrated  in   Figure      3.6,      the   pilot    is 
linked  to    the   control  actuators    by    electrical   wires. 
The   electrical   wiring  provides   the   control    signal    paths    tha- 
transmit      the   pilot's      commands      zo   the      servoactuators. 
Sophisticated   artificial      feel   devices   provide      feedback   tc 
the    pilot.        The    basic   FBW     control  system   configuration   is 
electrically   noisy,       and      the   aircraft   is    prone      to   pilot 
induced   oscillations.         To  aid   in  the   controllability    cf   the 
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CONVENTIONAL  HYDRAULICS: 
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Figure  3.4.      Hydraulic  Power  System   Hechanization 

aircraft,  a  series  of  electronic  filters  is  often  inserted 
in  the  system  between  the  pilot  and  the  electro-mechanical 
selector    device   to  reduce    nois9    transients. 

E.        COMPUTER    AUGMENTED    FBW   CONTROL    SYSTEM    BASICS 

High  speed  computers,  in-line  with  the  basic  FEW  flight 
control  system,  may  be  used  to  either  augment  or  provide  the 
controllability  of  the   aircraft.       Computsr    monitoring   of   the 
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Figure   3.5.      Hydraalic   Powered    Longitadinal   Control   System 

flight  environment  through  ths  addition  of  motion  and  rate 
sensors  coupled  to  the  ccmput«=r  relieves  the  pilot  of  The 
responsibility   to  continuously  monitor  his    flight   path. 

One  of  the  most  sophisticated  applications  of  a  digital 
computer  augmented  FBW  flight  control  system  in  a  military 
combat  aircraft  is  the  McDonnsll-Douglas  F/A-18  "Hornet." 
This  aircraft  employs  high  speed  digital  computers  i.i-lin.5 
with  a  state-of-the-art  FBW  system  to  provide  the  very 
latest  in  high  performance  aircraft  flight  control  systems 
technology. 
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FLY-BY-WIRE: 


ENGINE 


The  conventional  mechanical  linkage 
between  the  pilot's  control  input 
and  mechanical  controller  is  replaced 
by  an  electrical  signal  used  to 
activate  the  control  surface  actuator 


PTYDRO-MECHANICAL 
PUMP        VALVE         ACTUATOR 


^-a--H 


o- 


PILOT 


— o 


ELECTRO-MECHANICAL 
CONTROLLER 


Mechanical 

Hydraulic 

Electrical 


Figure    3.6,      Fly-by-Wire  Control  Systsm   Bechanization 

The    functional  design    cf      the   F/A-18    Digital   Fly-by-Wir« 
(DFBW)      flight   control  system   is    illustrated    in    Figurs    3.7. 
The   basic      mechanical  and      electrical    FCS      subsystems    are 
diagrammed      in  Figure      3.8.        The      basic   hydraulic      FCS 
subsystsms   are  depicted    in  Figure  3.9.        Note  the   mschanical 
back-up   components   for  controlling   the   pitch    and  roll    motion 
of   the  aircraft. 
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Figure    3.7.      F/A-18    FCS    FunctiDaal   Diagran 
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Figure  3.8.      F/A-18    FCS  Elsc/Mech   Subsystem   Diagram 


Figure   3.9.      F/A-18    FCS  Hydraulic   Subsystem    Diagrai 
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IV.       FCS    FAILURE/ CAM AGE    MODES    IDENTIFICATION 

A.        SYSTEM    VaiNERABILITY    CONTRIBUTIONS 

Each   individual   component   of    an     aircraft   has   a   Isvel   of 
vulnerability  that  contributes   to     the   overall   vulnerability 
of   the  aircraft.        Certain     components  conrribuxe   more    than 
others,      and      those    components      which,      when      damaged    or 
destroyed,    lead   to  an  aircraft  loss  are   the  ones   of  interest 
here.        These   components    are      known    as   critical   components. 
The    systemmatic     identification    of   the      critical   components 
and    the      quantification    of  the  vulnerability      of   individual 
components   is   a    part    of      the   overall  aircraft    vulnerability 
assessment.         As     the   vulnerability   contribution      cf   each 
component,    subsystem    and    system    is  assesssd,    various   methods 
may      be      implementsd      to    reduce      the     overall      aircraft 
vulnerability.        The    vulnerability      reduction  technique  (s) 
chosen  for      implementation  in   the      FCS   must    allow      the   FCS 
design  to    remain   within    the     constraints   of   cost,      weight, 
performance,    accessibility,  and    maintainability,      et   cetera 
imposed   by  contractual  agreement. 
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B.        IDENTIFICATION    OF    CRITICAL    COMPONENTS 

One  purpose  of  a  vulnerability  assassmant  is  the 
identification  of  those  components  whose  damage  or  loss 
could  lead  to  an  aircraft  kill,  A  gensral  procadurs  has 
been  formulated  for  determining  the  critical  components, 
their  possible  damage  or  failure  modes,  and  rhe  effects  of 
the  damage  or  failure  on  the  continued  operation  of  the 
aircraft   [  Bef .    1  ]. 

Fundamentally,      the      procedure    is   comprised     of  three 
steps: 

(1)  selection    of  an    aircraft    kill   level. 

(2)  formulation   of    a  complete    technical    and    functional 
description  of    the  aircraft. 

(3)  the   identification   and    delineation   of   the  critical 
compcnents. 

''•      Aircraft    Kill   Levels 

Combat   damaged  aircraft    and      aircraft    systems    suffer 
performance   degradations    in  varying   degrees.         The   level   tc 
which  the      performance  degradation      progresses   can,        in 
general,      be   categorized    as  an      attrition    kill,      a   mission 
abort   kill,    or   a    forced    landing    kill. 
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An   attrition      kill  is    defined      as    that      msasurs    of 
aircraft    damage   that      results   in    the   loss      of   the   aircraft 
from   the    inventory.       Repairabili ty   and  economy   of   repair   are 
factors    which   may  contribute   to    to   an   attrition    kill    without 
the    physical   loss  of    the      aircraft.         However,      it    is    the 
elapsed  time   from     damage   onset    to   eventual      aircraft    loss 
which  provides  the  scale    with   which   to   differentiate   between 
attrition   kill   levels.        Several   attrition    kill    levels   have 
been    defined;    such  as      "KK",    "K",    "A",    and   "B",    impressed   on 
a   time     to  aircraft      loss   scale.  Detailed    kill     level 

descriptions  are  contained  within  DOD 

MIL-STD-336-1   [Hef.    2]. 

A    mission  abort    kill   is      defined    as   that   measure   of 
aircraft    damage     which  results  in     an   aircraft,      failing   to 
complete   its   assigned  mission,    but    that   dees    not   result    in  a 
loss   of  the  aircraft    from   the   inventory. 

A    forced   landing    kill,         specifically   applicable   to 
helicopters,    VTOL,   and  certain   V/STOL   aircraft,      is   defined 
as    that   measure   of  aircraft   damage     that   causes   the  pilot   to 
land   his    aircraft   short    of  the   intended   iastination,    and  the 
failure   to      do  so  would   result      in   the   destruction      of    the 
aircraft. 
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2.      Aircraft   Tachnical  and   Functional    Dascri^r ^oii 

At   each      saccsssive  stage      of   the      aircraft   design 
process,      the     technical    and      functional    descriptions      of 
aircraft    systems      and  components      become    better      defined. 
These  descriptions,       with   individual     component   and   systems 
dimensions,    materials,      operations  and   functions   interfaces, 
scale  and      perspective  drawings,         and   aircraft      location 
profiles,      comprise   the    detailed    technical      base   for   use   in 
the    vulnerability  assessment.  Gathering   and   continuously 

updating   this   data  base,      as     it    is   f ormulaxed,      should   be 
given  a    very   high  priority. 

3-      Critical  Component  Identification    Procedure 

A      sequenced    procedure      has      been    formulated      to 
identify   the   critical   components   [Ref.    1].        The   first    step 
in   this   analysis     procedure  for    the   FCS   is      to   identify    the 
flight   essential     functions  that    the      FCS    must      perform    in 
order  to    continue  to    accomplish    the  aircraft's    mission.      The 
second     step   is      to    identify     those      FCS    subsystems      and 
components  that    provide    or     perform    the   assential    functions. 
The    third      step   is  to  conduct      a    failure    mode      and   effects 
analysis     (FMEA)      and/or      a  fault    tree   analysis       (FTAI       to 
identify    the   relationship    between      the   individual   component 
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or    subsystem      failure  and      the   essential,    f unc-ion  (s)       it 
provides    or   perforis.      The  fourth  step,    th-s   damage   modes   and 
effects    analysis    (DMEA)  ,      consists   of    relating    the   component 
or    subsystem   failure    modes  to      combat    damage   causes.         The 
final  step   in   the  process,      the    presentation    of   the   results, 
is   often    expressed     in  a    logical    sequence    )cnown      as  a    kill 
expression,   or   represented  graphically   as    a   kill  tree. 
*♦•      Procedural  Example  -  Generic   DFBW    ?CS 

To  illustrate     this  dynamic   process,        the   flight 
control   system  of  a    generic     fighter/attack  aircraft    will   be 
utilized.      The  time    scale   of  a   " B"   level   attrition   kill    will 
be    imposed   for   illustrative     purposes. 

A    schematic    representation   of      the    example   DFBW    PCS 
layout  is    shown     in    Figure  4.  1.         Specific     technical    and 
functional   interfaces  are   depicted   in   Figure    4.2.        The   FCS 
utilizes    dual,      high    speed     digital   compiters,      quadruple 
transmission      signal    paths,        two   independent      hydraulic 
systems,    and   dual,   tandem   hydraulic   actuators   at   all    control 
surfaces.  No   back-up      mechanical      control    linkage      is 

provided. 

Flight     essential    functions      are      those   that      are 
required   to      sustain    controlled    flight   with      qualities    not 
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Figure   U.I.      Generic   DFBi   FCS   Illustration 


lass   than    level    3  as    defined   by    MIL-F-8735C   [Ref.    3].         Each 

mission      phase   constitutes     an  evaluation      point   in     the 

process.  Mission    phases     foe      a   typical      mul-cipurpose 

fighter/attack  aircraft    include    takeoff,      climb,      outbound 

cruise,    descent,    target    ingress,    ordnanca    delivery,      -carget 

egress,    climb,    inbound  cruise,      descent,      and  landing,      as 

shown  in    Figure    4.3.         Figure      4.4    delinaatas   -^hose   flight 

essential    functions      in    a   typical      format    for      the   axample 

fighter/attack  aircraft. 
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Figure   U.2.      Technical/Functional  Interfaces   -   DFB»    FCS 

To   fly  and  conduct     the    aircraft's   mission   requires 
the   continued     operation    of     those    supporting      sysTisBs    or 
subsystems      that    provide      or   perform      the    essential     FCS 
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Figure  4,3.      Fighter /Attack    Mission   Profile  Phases 

function.         The   level   of    severity     and   tioae   criticality    of 
loss    of      these   supporting   systams      or   subsystams      musr    be 
evaluated    during   this    process    step.  Figure   4.5    depicts   a 

sample  tabulation  of    some    of      those    major    supporting   systems 
and   subsystems.        In      depth  and    detailed   analyses      of    each 
individual   supporting   element   must,    be   carried   out    as    each  of 
these  elements      becomes    sufficiently     dafinad   during      the 
dasign  process.        A      sample  tabulation   of    a      more    detailad 
analysis    is   presented   in    Figura    U.6. 
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data     base   provides  ^    the    basis      and      means    for      further 
refinements   of  the  detailed  supporting   sysrsms   analysis. 

The  third  phase  in  ths  analysis  procadurs  is  the 
failure  mode  and  effects  analysis  and/or  the  fault  tree 
analysis.         The      FMEA    is      a  "bottoms-up"      procedure   rhat 
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Figure   4.5.      Basic    Systems/Subsystems   Sapporting   The    FCS. 

identifies    all      possible    failure    modes     of   a      component    or 
system,       documents  these    failure    modes,      and    determines    the 
effect  of    each    failure   mode  on   the    performance   of  the    system 
as    a   whole.        The  details    of   the    FMEA    process,    and   specific 
procedures   can  be  found    in  MIL-STD-785   rasf-    4]. 

Component  failure   modes    generally      considered    in    an 
FMEA    include      failjre   to      operate,      failure      to   terminate 
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operation,        premature      operation,        aid      degraded      or 
out-of-tolerance   operation.        Unique   failure      modes   may   be 
singularly   inserted      in   this   stage      of   ths      process.         An 
example    FMEA   summary    report  for      a   hydraulic   control   surface 
actuator   for   the   example    FCS   is    presented    in    Figure  U.7. 
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Figure   U.7.      Exaaple  FMEA  Summary   Report    -    Hyd.    Actuator 
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The   actuator      becomes    a    critical   cDtaponen-      for   an 
attrition    kill      if   it      jams  ths      control    surface      in. to    a 
hard-over    condition,      but    it   is    not   a   critical   comoonent   if 
it    allows    the   control  surface   to    remain  unjammed. 

Another   analysis    procedare,    the  Fault   Tree   Analysis, 
employs   a      "top-   down"   approach    [Ref.    5].  This    approach 

differs    from   the    FMEA   in    that      it   assumes    an    undesired   event 
and   systematically      determines  what   failure   or      sequence    of 
failures    could  cause   the    undesired  outcome.      A   segment   of   an 
FT  A    for   the   example    FCS    is     presented    in    Figure   U.S.        The 
symbolcgy    utilized  in     the  FTA  analysis  is     common   to    logic 
systems   and,      as   such,      the  FTA      is   often    selec-ei    for   its 
suitability   with   computational   systems. 

FCS   faiLure      modes  that      cculd   rssult      in    aircraft 
attrition    have   beei    identified   for      the   example    FCS   and   are 
presented   in  Table  III. 

The   FMEA   aid    FTA    related      failure    modes    and  effects 
but    did      not    distinguish    the      possible   cause  (s)         of   the 
failure.         The      Damage   Mode     and    Effects      Analysis    (DMEA) 
provides    this   essential   relationship.  In   the    DMEA,      the 

component    and      subsystem    failures   are   rela-sd      to    specific 
damage  causing   mechanisms   and   damage    processes.      Included    in 
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TABLE   III 

Example  FCS    Failure   Modes   -   Attrition    Kill 

(1)  Loss   of   control   inputs 

(2)  Loss  of    motion   sensor  lata 

(3)  Loss  of    digital  compu-2r   control 

(4)  Loss   of   electrical   powsr    to    computer  (s) 

(5)  Loss   of   control  signal    path 

(6)  Loss  of   hydraulic   system    power 

(7)  Loss  of    control   surface    actuator 

(8)  Loss  of   control  surface 

these     primary      damage   mechanisms      are      projectiles      and 
fragments,      blast     effects   from    high      explosive   warheads, 
incendiary    particles,      and     High    Energy  Lasers    (HEL)  .        The 
damage  these      agents    may    cause  includes      severed   electrical 
power  distribution  lines,    sensor    signal  paths,      and  control 
signal  transmission    lines;      jammed      mechanical   linkages   and 
servoactuators ;      loss   of    hydraulic      pressure    and   hydraulic 
fluid  loss/leakage;         fire    (aggravated   by      petroleum    based 
hydraulic    fluid)  ;        HEL    burn-through   and      high   temperature 
heating      or   melting      of      FCS      components,      and      certain 
electromagnetic   incompatibilities  with   components,      devices, 
cables,    wiring,    and    connectors.       Secondary    daziage   mechanisms 
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resulting    from  the  impact     of   the      primary    agents   on   the   FCS 
include   fire,    explosion,    spalling,      stru::tural    def orna^-ion, 
sparks,    and   fluid  leakage.      The    DMEA   process    evaluates    causa 
and    effect,      and   quantifies  the      likelihood   of   the   outcome. 
Secondary    damage   causes,      resulting   from    ths    primary    damage 
mechanism    or   process,      are  included    in    the    evalua-ion    during 
this     analysis  phase.  Detailed     descriptions   of     the 

vulnerability     assessment     quantification        process     are 
presented    in   reference   1    and   in    MIL-STD-336-1    [Ref.    2]- 

Failure   modes  can  be     categorized    and   qualitatively 
aligned   with  the   various   damage      causing   devices   or  events. 
Figure      U.9   correllates      the   example      FCS    failure      modes 
presented    in     Table   III      with   common     conventional   weapons 
damage  causing  agents. 

The      next  step      in     the    vulnerability      assessment 
process      is  the      actual      determination     of   the     critical 
components      for      the      selected      kill      level      assessed. 
Distinguishing   between  redundant      and   non-redundant   critical 
components   is   essential    in  this    phase   of   the    analysis.         To 
clarify   this    important  distinction,      a    set    of   components   is 
defined   to   be    redundant    if  the   loss   of   one    or   more   than   one, 
but    not    all  of   the  components,      does  not   result    in    the    loss 
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Figure   U.9.      PCS    Failure   Hodes/Damags    Causing   Agents 

of    the  essential   function   these    components    perform.      If   this 
distinction      can     not      be    made,         the      ::omponents      are 
non-redundant.        As    an  example,    the    quadruple   control    signal 
paths  shown   for      the    example   FCS    form      a   multiply   rsdundant 
system      because   t.he      essential  function      of    providing      a 
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continuous   signal  path   is   maintained   evan    though   ons   or    more 
than   or.s    individual    path    may    bs    rendered    discontinuous. 

Another   distinction     regarding   redundancy     must   be 
made.        The  term   "analytical   redundancy"    refers   to   a   .'nethod 
whereby   a    computational    algorithm   is      used    ro   predic*:    an    end 
event   or      parameter.        Then  the      prediction  and      a    sensor 
derived   measurement    are    compared,      and   subsequent    action (s) 
taken.  While    not      fitting   the      precise    definition      of 

redundancy,      the   computational  results   can    be   suitably    used 
in    lieu   of   the  sensor  output   in    certain  circumstances. 

The  determination   of  the    critical    components   and   the 
presentation   format    are   often   presented     in   a   "kill  tree"    or 
"kill  expression."     Referring      to  that  portion   of     the    kill 
tree    shown    in   Figure    4.10,        the    physical   relationship   to  a 
tree   is      apparent.        The      severance   of     sufficient   trunk 
segments    may   result    in   the  loss    of     the  tree   and   in   the   case 
of   the  PCS,    the   loss    of   the  aircraft. 

Once  identified,  the  critical  oomponents  may  be 
subject  to  various  engineering  redesigns  to  reduce  their 
contribution   to  the    vulnerability  of  the   aircraft. 
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V.        FCS    SURVIVABILITY     DESIGN    SaiDELINES 

A.       GENERAL    FCS    DESIGN   PRINCIPLES 

General   design  principles  to    reduce   vulnerability   should 
be    exercised   to   ths    fullest      extent    possible   throughout    th3 
FCS    design      process.        Commencing   with   ths      initial   dssign 
phases,    a    full  measure  of    consideration   must    be   given    to   tha 
combat  survivability      of    the    flight  control      system.         Of 
course,    the   desire   for  increased   survivability    of   the    flight 
control   system   must      be    prudently   balanced   with      the   other 
requirements  of  reliability,    maintainability,    accessibility, 
repairability,      and    safety.  Concurrently,      the   fullest 

measure   of   performance      must   bs    achieved,      and      all   these 
factors   must   be   suitably   combined     within    stringent  cost   and 
weight   constraints.         In    the   end,      the   design   of   ths    FCS   of 
military   combat     aircraft    must   include      suitable   protection 
from   the    primary    damage      causing    mechanisms   of   conven-ional 
threat   weapons  systems. 

The    six  survivability    enhancement      concepts    developed    in 
Chapter    II    (Table  II,      page   19)       provide   the    foundation    for 
the    general   FCS   design   principles.  In    general,      the    FCS 

design  principles  contain   provision      for    component   location 
and   shielding   to   reduce    potential   damage    risks;      elimination 
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(via      redesign)       of      high   rislc,         singls    point      failure 
components;    componsnt  redundancy    with   adequate   separation  of 
redundant      components  to      maintain      the   assential      flight 
control   function;        and   the  incorporation    of      passive   and 
active  damage   suppression   devices  and    tschnigues   re   minimize 
the    effects   of   incurred    damage.  A   flight   control   syst?m 

design  that     includes  no      single    point     till    possibilities 
should  be    considered   a   design   goal. 

B.        SURVIVABILITY   DESIGN    GUIDELINES    FOR    FBW    FCS 

Specific  survivability  design  guidelines  applicable  to 
the  individual  coaponents  and  subsystems  of  a  Fly-by-Wire 
Flight  Control  System  have  been  formulated  and  are  herein 
presented.  The  decision  to  incorporate  any  or  all  of  the 
design  guidelines  must  be  made  prudently  and  with  sound 
engineering   judgement. 

"••      Mechanical  System   Components 

a)      Flight  Control  Surface   Panels 
Where  possible: 

•  Design   control   surface   panels    of   lightweight 
composite      materials      which      exhibit      hign 
strength-to-weight      ratios        and      integral 
redundant    load   carrying      capability   for    high 
ballistic    damage    tolerance. 

•  Incorporate  smooth   surfacs    transitions    to 
reduce  aircraft   signatures. 

•  Incorporate  multiple    surface    panels    on    each 
control   plane     to    provide      redundant   control 
surfaces    for  maximum    reconf igurability. 

•  Utilize  heat  resistant    surface   material   or 
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ablative    materials  to   rstard   HEL   barnthrough. 

b)  Hinges/Control  Linkages/Bearing   Assemblies 

Where  possible: 

•  Design   components   to    be   jam-free. 

•  Utilize  self-aligning  bearings    (e.g. 
tri-p^ivot    bearings)      to   minimiza    misalignment 
and   jamming  due   to  control    rod,    aczuator    arm, 
or  control   surface   panel   de formation. 

•  Minimize  the  length  of  mechanical  control 
linfeag®s  to  reduce  the  probability  of 
deformation  or  distortion. 

•  Utiliz?   ballistically   damaae  tolerant 
composite      materials    for     control   rods      and 
torque  tubes. 

•  Design   fairleads.    bellcranlcs,    and   idler 
assemblies   to    allow    a      measure   of   functional 
performance  if   damaged. 

•  Install   primary   drive  motors,    control 
linkages,        interconnecting    devices,        and 
bearing      assemblies    in      close    proximity      to 
primary  structural  members      to   take   advantage 
of  the      shielding    afforded      by   the      primary 
structure. 

•  Ensure  that   that    all   control   surfaces    are 
fitted   with  a   "trail   safe"    positioning    device 
to  prevent    hardover    conditions      in   the    event 
of  the   loss  of    the   drive   linkage. 

c)  Servcactuators 

Where  possible: 

•  Design   all   servoactuators   with   redundant 
power    sources    (e.g.    dual  cylinder   actuators). 

•  Design   actuator  pistons   of    frangible  or 
malleable      materials      to        minimize      the 
possibility  of    jamming. 

•  Design  actuator  barrel   assemblies   of  high 
strength    steel   for      high   ballistic   resistance 
(e.g.    Electro-Slag   Remelt    (ESR)    Steel) . 

•  Design   the    actuator   outer-barrel   assemblies 
to  prevent   crack    propogation. 

•  Install  servoactuators    in   close   proximity    to 
primary      structural      members      for      maximum 
shielding. 

•  Install  rate  and    position    feedback    linkages 
m     close    proximity      to   the      servoactuator 
assembly    for  maximum   shielding. 
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•  utilize  integral    reservoir,    pump,    and 
electric    pcwer   packages      when    possible    (e.g.   - 
Integrated    Actuator    Packages    (lAP) ) . 

•  Incorporate   metallic   seals    in    place   of 
polymeric    seals   for    HEL   projection. 

•  Coat    actuator  housings    with    high   temperature 
resistant      or   ablative      materials    for      HEL 
burnthrough  protection. 

•  Incorporate  high  strength  ablative  armor  in 
areas    of   critical   componaats. 

•  Incorporate  very  high  signal- to-noise  ratio 
servovalves  for  increase!    EMI    tolerance. 

2»      lill£^ii£  Power    Systems 

a)  Fluid  Pressure  Generation   Subsystems 

Where  possible: 

•  Design   hydraulic    power   sources   to   be  single 
or  double   redundant    (e.g.         separate  dual   or 
triple  hydraulic    power   sourcas) . 

•  Physically   separate   hydraulic   power   sources 
as  much  as   possible   to    reduce    the  single    shot 
kill      probability    of      a   multiple      hydraulic 
system. 

•  Install   power  sources   in   close   proximity   to 
main    structural      members   to      provide  maximum 
shielding. 

•  Incorporate  high    temperature  resistant    or 
ablative    material    coatings      on    hydraulic   pump 
casss    to    increase    HEL   burnthrougn   tolerance. 

b)  Fluid  Pressure  Distribution  Subsystems 

Where  possible: 

•  Design  fluid  pressure   distribution    systems   of 
high    strength,         high  temperature      tolerant 
steel    lines. 

•  Incorporate  single  or   double   redundant 
distribution  lines      on   each      separate    fluid 
pressure   system. 

•  Incorporate  flow    sensors,    check    valves,    and 
switching    circuits   to   bypass    damaged  segments 
of  distribution  lines. 

•  Incoi;porate  reservoir  ].evel  sensing  devices 
to  isolate  damaged  distribution  lines  to 
prevent   fluid   loss. 

•  Install  distribution  lines    in   close   proximity 
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to     main      structural   meabsrs      to      maximize 
shielding. 

•  Utilize  very  high    pressure     (i.e.    UOOO-6000 
psi)     systems  to  reduce    prasented   area. 

•  Utilize  high  temperature   resis-ant 
synthetic-Based   hydraulic   fluid      to   reduce   or 
eliminate    firs    potential. 

3»      Electronic  S2,stem    Compon  ents 

a)  Flight  Control  Avionics  Components 
Where  possible: 

•  Design  all   primary  FBW   FCS    avionics 
components   with      multiple   redundancy      (e.a. 
multiple    LVDT  control   input      sansors  on    each 
control  axis      input,      ana      jiul-^.iple   diaital 
flight  control  computersi. 

•  Separate    redundant   avionics    components    to 
minimize    single   shot   kill   probabilities. 

•  Design   all    avionics    component    cases   of    high 
strength      steel      for        maximum      ballistic 
resistance, 

•  Coat    all   avionics   component   cases   with    high 
temperature  resistant   or      ablative   materials- 
for  maximum  HEL  burnthrough    protection. 

•  Design  shock  mounts  for  internal  and  external 
components  to  withstand  vibration  and  weapons 
induced  shock  loads. 

•  Install  avionics    components   in   close 
proximity   to  primary      structural    members    for 
maximum  shielding. 

•  Incorporate  high    temperature   resistant    or 
ablative    armor   in      areas  surrounding   critical 
components. 

•  Design  electronic    componants   with   suitable 
particulate,   vapor,    and   moisture   protection. 

b)  Electronic  Circuit  Design 
Where  possible: 

•  Design   input/output   circuits   of   very  high 
Signal-to-Noise    (S/N)      ratio      components    for 
maximum  EMI   protection. 

•  Minimize    capacitive    and   inductive 
cross-coupling    in    electronic   circuits. 

•  Incorporate  suitable   self-protect,    ensrgy 
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dissipative  circuits   to   provide   lightning   and 
EMI/EHP  protection      (e.g.      fusible     links, 
filters, or   spark-gap   devi3  =  s)  . 

•  Provide  S9pa:;ats    and   redundant   analog 
chamels,       with  separate   voting   logic,      as   a 
backup   to    the   digital  controller. 

c)  Signal  Transmissioii    Paths 
Where  possible: 

•  Design   single  or    double   redundant   signal 
paths    between   each  componrQt      or    elemsnt    in   a 
signal   path. 

•  Provide  suitable    separation   between   rsdundan- 
signal      transmission    lin9=      to   reduce      the 
single   shot  kill    probabili*- y. 

•  Route    signal  transmission   lines    in   close 
proximity   to  primary      structural    members    fcr 
maximum   shielding. 

•  Provide  adequate    electroEnagnetic   shielding  to 
reduce   EMI. 

•  Utilize  high  temperature   resistant   wire 
covsring    to  maximize      thermal/fire   protection 
and  to   minimize  HEL   burnthrough. 

d)  External    Sensors/Ancillary  Subsystems     - 
Where  possible: 

•  Design  multiple  redundant  external  sensors 
and  ancillary  subsystems  (e.g.  Air  Data 
Computers,    and   Angle   of   Attack   systems). 

•  Incorporate  high    temperature   resistant    or 
ablative    material    armor   for    thermal,      HEL   and 
ballistic    damage    tolerance. 

•  Provide   separate,    redundant    motion   and    rate 
sensors  on   each  of   the    thrse   aircraft    axes. 

•  Mount    sensors  to    primary   structural   members 
for  maximum  shielding. 

•  Provide   analytically    redundant   sensory 
outputs  for  use   as  checks,      and   as   potential 
back-ups. 

•  Provide  adequate    built-in   test   circuits    with 
suitable    failure    warning  indications. 

•  Incorporate  separate   and   widelv   displaced 
sensor   signal   transmission    patlis. 

e)  Pilot  Control   Inputs 
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where  possible: 

•  Design   redundant    control   sti::k   and   ruid^r 
inpat    sensor  contacts. 

•  Utilize  sequenced    voting  logic   and  multiplex 
control  commands      to   each      of   the  central 
processing      units      of   ths      flight  control 
computer  (s)  . 

•  Incorporate  seoarate   and   widely   displaced 
input    command  signal   transmission   paths. 

'♦•      Electrical  Power    System 

a)  Electrical  Power  Generation 
Where  possible: 

•  Design  electrical  power  generation  sys-ems  to 
be  multiply  redundant  (s.g.  dual  generators, 
each    with    single    generator    capability) . 

•  Incorporate  multiply   redundant   AC/DC 
conversion    elements. 

•  Utilize   autcmatic/manual   or    manually 
activated      ram     air        "curbine      emergency 
generators,      with    separate      AC/DC   conversion 
elements. 

•  Design   battery   back-up  systems.* 

b)  Electrical  Power   Distribution 
Where  possible: 

•  Design  electrical    bus  distribution    systems 
for   "cross-over"    transient- free   operation. 

•  Incorporate  redundant  control    signal/power 
wiring   to    lAP    (if    utilized)  . 

5-      Environmental  Control   System 

Where  possible: 

•  Design  separate   and    redundant    a    priori 
distributed       heating  and        cooling, 
pressurizaticn ,      and    volumetric    flow  systems 
to  critical  components    (e.g.      flight   control 
computer  (s) ) . 

•  Incorporate  fail-safe  temper?iture,    pressure, 
and      volume   flow      sensors       (i.e.      a      safe 
operating    condition      is   maintained      should    a 
failure  occur)  . 
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•  Prov3.d?  ram  air  emergency   cooling   to   heat 
sensitive    components. 

•  Design   adequate   particulats,    vapor,    and 
moisture      control    devices      m    primary      and 
emergency    cooling    and    prsssurization   systems, 
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VI.       SDMMARY   AND    RECOMMENDATIONS 

A.  SUMMARY 

In  summary,      it    has    been   the    author's    desire   to   present 
in    a   single   document    a  clear-cut      set   of   guidelines   for   the 
development   of  aircraft    flight   control   systems   wi-h  specific 
emphasis    on   increasing  the     combat   survivability   of   aircraft 
equipped    with      FBW  flight    control  systems.  The    saaterial 

presented    and  the  guidelines  delineated      have   resulted    in   a 
document    that     is  as    complete      and   concise   as      any   single 
source  document     can    be    when     dealing   with      a   fast-paced, 
highly  complex     technical   subject.        This      document   should 
therefore    be      viewed    as      a  dynamic     tool   thai:      reflects   a 
continuous      chain  of      ongcing     thoughts     and    ac-ions      to 
constantly   update  and   strengthen    the  quality,    capability   and 
survivability   of   the    combat  systems   of   our   Armed   Forces. 

B.  RECOMMENDATIONS    FOR    FUTURE    ACTIONS 

Enhanced   survivability  alternatives      achievable  through 
digital   FBW      FCS   technology  should    be      investigated   fully. 
One    such    survivability  enhancement    alternative,      achievabla 
through      digital     technology,         is      a      "self-healing", 
reconfigurable  aircraft    flight  control   system. 
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Consider   for      a    moment  that    you      are   the    pilot      of   an 
aircraft    that    has  just  been  hit    by   enemy   grour.d-f ire.         Yea 
feel    the      dull  thud    as     the  enemy   projectile      impacts    your 
aircraft's   aft   fuselage    area   and      now    you    sense   the  aircraft 
beginning    to    pitch  and  roll  without   command.         Your  survival 
instinct    tells      you    to  try     every  possible      combination    of 
stick     and  rudder     input    to     counter  thi      out-of-control 
aircraft      motion.  Nothing     seems      to     correct      the 

situation your    final     thought   prior    to      ejecting    from 

your   stricken  craft    is   "if  only " 

This    hypothetical   example      is  but   ons    of      many   possible 
combat  related  incidents   that    might      be   resolved  in  another 
way    through   the   use    of     digital    technology.        Consider    the 
possibilities   afforded     by  digital   technology      in   regaining 
control      over   a     combat      damaged      aircraft    as      in     the 
aforementioned     example.         With      one      of    the      horizontal 
stabilators  gone,      an   alternate      combination    of   primary   and 
secondary      control  surfaces     might   be      commanded   by     the 
computer   to   return  the  aircraft    to    controlled   flight.         This 
proposed      survivability    enhancement      altsrnative   could      be 
obtained      with      minimal   additions      to      presint      digital 
fly-by-wire   flight   control  configurations.         The   addition   of 
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a    sensor      suite,      to    detect     and    identify      damaged   flight 

control   components,         and   a     computational   algorithm      to 

reconfigure  the   aircraft   control    surfaces,    similar   in    nature 

to    that   used   in   artificially   intelligent    robot    devices,      ars 

all   that      is   required.        Without      question,      succsssfull 

achievement  of  such    an     adventuresome   engineering  task    would 

require   a    dedicated   effort.      Outlined    in   the    following,    is   a 

plan   to   accomplish     such    a  project.        It      is   the   author's 

opinion   that      sincere  thought   and  consideration     should   be 

given  to    such  an   undertaking  in    the   near  term. 

A     plan     to   develop      an     artificially      intelligent, 

reconfigurable  flight   control   system     «fould  require  detailed 

engineering  analyses    of    the  following   areas: 

•     Computational    aaalysis,    and   wind   tunnel    determination 
of    aerodynamic  lift,      drag  and   moment   coefficients   on 
simulated   combat    damaged    aircrafc    models    (e.g.       model 
testing  of  missing,      jammed    or   trailing-f ree   control 
surfaces   m  single    and   multiple   combinations). 


Development  of  control   sur 

alternatives. 


rface    raconf igurability 


•  Development  of  suitable   sensors  to    defect   the    various 
levels   and  nodes    of  combat    damage. 

•  Development  of   a    sequenced   logic   or   built-in   test 
routine  to  verify    flight    con-rol   system   configuration 
and   status. 

It     is   the      author's      opinion     that   the      fundamental 

technology      and      expertise     are        present      within      the 

military-industrial    community    to      achieve    the   aforementioned 
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survivability   enhancemsnt    alternative      at    low   rechnological 
risk   and   low   cost.      It   is   hoped    that   tomorrow's   history   does 
not    show    the    way   to    progress    in    aircraft    survivability. 
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